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Can  Biometrics  Help  the  Army  Solve 

An  Identity  Crisis?  20011015  005 


The  Army  is  having  an  identity  crisis,  and  it  affects 
both  its  wartime  and  peacetime  operations.  Simply  put, 
the  Army  needs  to  ensure  that  the  right  people — and  only 
the  right  people — can  get  access  to  its  information  sys¬ 
tems,  its  weapons,  and  its  many  databases  that  serve  the 
Army  community.  Biometrics — that  is,  physical  character¬ 
istics  or  personal  traits  that  can  be  measured  quickly — 
may  offer  a  solution.  But  using  biometrics  raises  some 
knotty  legal,  ethical,  and  sociological  issues— for  example, 
how  to  safeguard  biometric  information  so  it  cannot  be 
used  for  other,  possibly  nefarious,  purposes.  The  Army 
has  been  studjjmg  these  issues  and  has  been  considering 
the  feasibility  of  establishing  a  biometric  research  center 
that  could  serve  as  a  central  data  repository  and  carry  out 
test  and  evaluation.1 

The  Army  asked  RAND's  Arroyo  Center  to  help  it 
come  to  grips  with  these  issues.  The  results  of  the  Arroyo 
Center  work  have  been  published  in  Army  Biometric 
Applications:  Identifying  and  Addressing  Sociocultural 
Concerns.  Major  conclusions  of  the  research  include  the 
following: 

•  No  significant  legal  obstacles  bar  the  Army  from 
establishing  a  biometrics  program  in  the  United 
States. 

•  Valid  sociological  concerns  exist,  particularly  in  the 
area  of  privacy,  but  these  can  be  addressed  by  existing 
Army  regulations  (minimally)  and  by  installing 
additional  safeguards. 


^he  Army's  biometric  work  has  assumed  more  importance  since  it  has 
been  designated  the  Department  of  Defense  Executive  Agent  for  biomet¬ 
rics  used  for  information  assurance.  To  learn  more  about  the  DoD  pro¬ 
gram,  see  their  Web  page  at  www.c3i.osd.mil/biometrics. 


•  A  centralized  repository  for  biometric  data  may  be 
necessary.  However,  the  size  and  functions  of  such  a 
center  could  easily  fuel  public  concerns  over  privacy 
and  other  issues.  Therefore,  the  need  for  it  must  be 
justified  by  a  careful  analysis  of  the  problems  to  be 
addressed. 

WHAT  BIOMETRIC  TECHNOLOGIES  ARE  AVAILABLE 
AND  WHAT  CONCERNS  DO  THEY  RAISE? 

Many  biometrics  exist,  but  eight  primary  ones  have 
been  either  used  or  tested  in  both  public  and  private  set¬ 
tings.  The  most  familiar  (and  longest  used)  biometric  is  the 
fingerprint.  Others  include  hand  (or  finger)  geometry, 
facial  and  voice  recognition,  iris  and  retinal  scan,  signature 
verification,  and  keystroke  dynamics.  With  varying 
degrees  of  certainty,  all  can  identify  a  specific  individual. 
However,  they  also  vary  in  their  intrusiveness,  the  degree 
to  which  the  public  accepts  them,  and  the  types  of  issues 
they  raise.  The  Arroyo  Center  research  identified  three 
major  categories  of  concern:  information  privacy,  physical 
privacy,  and  religious  objections. 

Information  Privacy 

By  far  the  greatest  concern  was  about  an  individual's 
ability  to  control  personal  information.  Not  surprisingly, 
misuse  of  the  information  ranked  high  on  the  list  of  infor¬ 
mation  privacy  issues.  Widely  publicized  accounts  of 
identity  theft  and  financial  loss  stemming  from  it  have 
made  people  nervous  about  any  information  that  could 
enable  someone  to  assume  their  identity.  Biometric  data, 
though  more  complex  than  most  passwords,  can  also  be 
stolen  or  copied,  so  any  attempt  to  develop  a  system  using 
it  must  take  these  concerns  into  account. 


Misuse  is  not  the  only  information  privacy  concern. 
Some  worry  about  "function  creep" — that  is,  using  infor¬ 
mation  collected  for  one  purpose  to  do  something  else. 
These  secondary  purposes  may  be  perfectly  valid,  but  if 
people  have  not  been  informed  about  the  new  use  and 
have  not  consented  to  having  information  about  them 
applied  to  it,  they  could  object.  Another  worry  is  that  bio¬ 
metric  information  will  enable  a  third  party  to  track  an 
individual's  actions  or  search  databases  to  get  information 
about  them.  Using  a  biometric  to  participate  in  routine 
daily  activities  (e.g.,  entering  or  exiting  buildings,  making 
financial  transactions)  leaves  a  detailed  record.  This  capa¬ 
bility  bothers  many  people,  who  worry  that  some  biomet¬ 
rics  may  allow  their  activities  to  be  monitored  without 
their  knowledge  or  consent. 

Physical  Privacy 

Unlike  some  other  identifiers — a  Social  Security  num¬ 
ber,  for  example — biometrics  raise  issues  of  physical  pri¬ 
vacy.  One  is  that  certain  biometrics  carry  a  stigma. 
Fingerprints,  for  example,  are  widely  associated  with 
criminal  activity.  Another  issue  is  concern  about  actual 
physical  harm.  While  the  research  team  found  no  biomet¬ 
ric  that  causes  such  harm,  it  nonetheless  troubles  some. 

For  example,  retinal  scanning  techniques  require  individu¬ 
als  to  place  their  eyes  close  to  a  camera  lens,  a  requirement 
that  makes  some  people  uneasy.  Hygiene  issues  also  con¬ 
cern  some.  The  need  to  place  a  hand  or  finger  on  a  sensor 
plate  can  prompt  fear  about  the  spread  of  disease. 

Religious  Objections 

Certain  Christian  sects  have  objected  to  the  use  of  bio¬ 
metrics  based  on  the  "Mark  of  the  Beast"  language  in  the 
Book  of  Revelation.  Although  the  number  of  such  believ¬ 
ers  is  relatively  small,  some  members  of  the  Army  com¬ 
munity  might  hold  similar  beliefs.  The  Army  needs  to  be 
prepared  to  address  such  objections. 

HOW  CAN  THE  ARMY  MITIGATE  CONCERNS? 

Many  of  these  concerns  are  not  new,  and  the  Army 
has  rules  and  regulations  in  place  to  address  them. 
However,  widespread  use  of  biometric  technologies  is 
new,  and  the  Army  should  review  its  current  policies  and 
regulations  to  ensure  that  they  address  the  concerns 
people  have. 

The  Privacy  Act  of  1974  is  the  most  prominent  piece  of 
federal  legislation  governing  the  use  by  the  federal  gov¬ 


ernment  of  personal  information.  Generally,  the  Act  pre¬ 
cludes  the  federal  government  from  disclosing  personal 
information  without  the  consent  of  the  person  who  pro¬ 
vided  it.  It  specifies  the  minimum  that  the  Army  must  do 
to  protect  the  information,  but  the  Act  contains  many 
exceptions. 

The  Army  could  rely  on  existing  law  and  regulation  to 
protect  any  biometric  data  it  might  collect,  but  it  may  wish 
to  take  a  broader  and  more  integrated  approach.  A  first 
step  would  be  simply  to  explain  thoroughly  why  a  bio¬ 
metric  is  the  best  solution  to  a  given  problem.  A  full 
understanding  of  the  issues,  including  costs  and  benefits, 
could  help  the  program  win  acceptance.  If,  for  example, 
the  Army  wished  to  substitute  fingerprint  recognition  for 
computer  and  database  passwords,  it  might  highlight  the 
problem  of  lost,  forgotten,  or  purloined  passwords.  On  the 
positive  side,  it  could  emphasize  the  convenience  and 
elimination  of  the  need  for  periodic  password  changes. 

As  a  second  step,  the  Army  could  structure  the  pro¬ 
gram  to  minimize  the  effect  on  privacy.  To  allay  the  sorts 
of  concerns  described  above,  the  Army  might  want  to  do 
more  than  the  minimum.  It  could,  for  example,  establish  a 
policy  that  its  biometric  information  would  not  be  shared 
with  any  other  organization,  similar  to  the  rule  that  the 
Department  of  Defense  has  for  protecting  DNA  samples  it 
has  collected  as  part  of  its  program  to  identify  human 
remains.  Establishing  policies  about  sharing  data  from  the 
outset,  decentralizing  storage  locations  or  storing  the  data 
with  the  individual  (e.g.,  on  a  smart  card)  could  alleviate 
many  concerns. 

A  third  step  would  involve  a  vigorous  education  pro¬ 
gram.  Such  a  campaign,  aimed  at  soldiers,  family  mem¬ 
bers,  and  the  public,  could  not  only  allay  fears,  but  it  could 
also  build  support  for  the  program.  Finally,  the  Army 
should  assign  clear  responsibility  for  each  step  outlined 
above. 

A  BIOMETRIC  CENTER  IS  FEASIBLE 

From  a  sociocultural  perspective,  it  is  feasible  for  the 
Army  to  establish  a  center  to  store  biometric  data  and  test 
and  evaluate  biometric  technologies.  Among  the  legal, 
technical,  regulatory,  operational,  and  security  issues  that 
must  be  addressed,  the  most  sensitive  aspect  of  such  a 
center  is  the  repository  component,  particularly  its  size, 
purpose,  and  organizational  assignment.  Concerns  over 
these  issues  are  likely  to  depend  on  whose  information  is 
included  in  it  (e.g.,  servicemembers  only.  Department  of 
Army  civilians,  contractors,  retirees,  dependents),  what 


purposes  the  information  serves  (e.g.,  benefit  eligibility, 
installation  access),  and  who  has  access  to  it  (e.g.,  other 
services,  law  enforcement  agencies). 

WHAT  SHOULD  THE  ARMY  DO? 

As  the  Army  continues  its  study  of  biometrics  and 
their  applicability  to  its  needs,  it  should  consider  the 
following: 

•  Demonstrating  its  commitment  to  individual  privacy 
by  placing  strict  limits  on  sharing  biometric  data  with 
other  organizations. 


Providing  a  detailed  analysis  of  the  problems  that  bio¬ 
metrics  can  help  solve. 

Justifying  any  central  repository  in  the  same  way  it 
justifies  its  biometric  program. 

Participating  in  the  U.S.  government's  Biometric 
Consortium. 

Exploring  the  issues  of  international  law  that  might 
affect  implementation  of  a  biometric  program 
overseas. 
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